Windows Message Queuing EUVD-2026-99088

Requires the target to have the Windows Message Queuing (MSMQ) optional feature installed and running, with its MSMQ listener reachable over the network (typically TCP port 1801); this feature is NOT enabled by default on Windows, which is the single largest limiting factor on exploitability. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any attacker who can reach an enabled MSMQ endpoint can attempt it. The main remaining limiter is AC:H: as a use-after-free (CWE-416), successful exploitation depends on winning a race / achieving a specific memory state, reducing reliability and ruling out trivial point-and-click attacks against default installs.

This is a genuine high-priority vulnerability but with meaningful real-world friction. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes network-reachable, unauthenticated code execution with no user interaction and full C:H/I:H/A:H impact (CWE-416 use-after-free), which maps cleanly to the 8.1 score. The single tempering signal in the vector is AC:H - consistent with a use-after-free that requires winning a memory-state race or heap-grooming, meaning exploitation is not trivially reliable. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. KEV status is not present (no active-exploitation signal) and no POC is referenced, so this is not confirmed as currently exploited. Note a conflict worth flagging: the input Tags include 'Denial Of Service' while the description and impact metrics describe remote code execution - the A:H component makes a DoS outcome plausible as a secondary effect, but the primary vendor-described impact is RCE; treat the DoS tag as a lesser/secondary characterization, not the main risk. The practical risk is gated far more by exposure than by severity: MSMQ is an optional, non-default Windows feature, so only environments that have deliberately enabled it and exposed TCP 1801 are affected. For those environments this is a serious, patch-now issue given the unauthenticated network RCE profile; for everyone else it is not reachable.

An attacker with network reachability to a Windows host running the Message Queuing (MSMQ) service (TCP 1801) sends a sequence of crafted MSMQ protocol messages designed to trigger the use-after-free, then grooms the heap to win the race (reflecting AC:H) and redirect execution. On success the attacker runs arbitrary code in the context of the MSMQ service without authentication or user interaction. No public exploit code is identified at time of analysis, and the high attack complexity means a working exploit would require non-trivial reliability engineering.